3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37

General

Target
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37
Size 263KB
Sample240426-xtafqaab73
SHA256 3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37
MD5 f572d2cf74a7897bebb459dc08a45411
SHA1 9a6bc0b9670cf1e5ea21876c1a71bafdec32017f
SHA512 d75df9d31d36776841854c3708727219380cd8731d0669fd18be634047b7526299bd5e5fa561385e7dce458edee417f08ed779b3a590dc9a71450f6ef3557a33
SSDEEP 3072:Y2e/zGhApVVIbW+UHPiXQGDL5mc4IRKU1uhIrueTi21TE7idvqjfyJ+dELqPtPe:OzCbWeQmLomRTVxT4O87dEL4t
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37

File Explorer

3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37

.exe 263KB

3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37

IMPHASH dbc480346b6d3d9e89c5339bb11a03d5
SHA256 3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37
MD5 f572d2cf74a7897bebb459dc08a45411
SHA1 9a6bc0b9670cf1e5ea21876c1a71bafdec32017f
SHA512 d75df9d31d36776841854c3708727219380cd8731d0669fd18be634047b7526299bd5e5fa561385e7dce458edee417f08ed779b3a590dc9a71450f6ef3557a33
SSDEEP 3072:Y2e/zGhApVVIbW+UHPiXQGDL5mc4IRKU1uhIrueTi21TE7idvqjfyJ+dELqPtPe:OzCbWeQmLomRTVxT4O87dEL4t
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17103

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ximifo.pdb

kernel32

GetLocaleInfoA FindResourceExW LocalCompact InterlockedDecrement GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsA GetUserDefaultLangID SetCommState LoadLibraryW ReadConsoleInputA WriteConsoleW GetModuleFileNameW MultiByteToWideChar GetTempPathW GlobalMemoryStatus ChangeTimerQueueTimer SetLastError GetThreadLocale GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA LocalAlloc GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetOEMCP LoadLibraryExA VirtualProtect SetCalendarInfoA GetConsoleProcessList GetVolumeInformationW GetLastError GetSystemDefaultLangID GetStringTypeW HeapAlloc EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetProcessHeap EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize GetFileType GetStartupInfoW CloseHandle GetCurrentThreadId GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo OutputDebugStringW SetStdHandle SetFilePointerEx HeapReAlloc LCMapStringW CreateFileW

advapi32

DeregisterEventSource

winhttp

WinHttpOpen

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37

kernel32

advapi32

winhttp

generic